home

CALC.EXE

Windows Calculator application file

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The file CALC.EXE, “Windows Calculator application file” has been detected as malware by 37 anti-virus scanners.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft® Windows® Operating System

Description:
Windows Calculator application file

Version:
5.2.3790.0 (srv03_rtm.030324-2048)

MD5:
cebfd912b22acf73e2dd4730961537ac

SHA-1:
bf3151a56cdba7d43e1cdefc9683f7bb78ad37f8

SHA-256:
1789e491c7f3f60dd8bcc002bb0fc31528f91adbd447b69b7f29e14d2ecc1128

Scanner detections:
37 / 68

Status:
Malware

Analysis date:
4/25/2024 2:04:10 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.2078594
655

Agnitum Outpost
Backdoor.Papras
7.1.1

AhnLab V3 Security
Malware/Win32.Generic
2015.04.04

Avira AntiVirus
TR/Crypt.ZPACK.120484
3.6.1.96

avast!
Win32:Crypt-RQY [Trj]
2014.9-150421

AVG
PSW.Generic12
2016.0.3133

Baidu Antivirus
Backdoor.Win32.Papras
4.0.3.15421

Bitdefender
Trojan.GenericKD.2078594
1.0.20.555

Bkav FE
W32.QuastihusLTC.Trojan
1.3.0.6379

Comodo Security
TrojWare.Win32.PSW.Papras.~A
21644

Dr.Web
Trojan.PWS.Stealer.13437
9.0.1.0111

Emsisoft Anti-Malware
Trojan.GenericKD.2078594
8.15.04.21.08

ESET NOD32
Win32/PSW.Papras.DT
9.11423

Fortinet FortiGate
W32/Papras.DT!tr.pws
4/21/2015

F-Secure
Trojan.GenericKD.2078594
11.2015-21-04_3

G Data
Trojan.GenericKD.2078594
15.4.25

IKARUS anti.virus
Trojan.Win32.PSW
t3scan.1.8.9.0

K7 AntiVirus
Password-Stealer
13.202.15480

Kaspersky
HEUR:Trojan.Win32.Generic
14.0.0.2158

Malwarebytes
Trojan.FakeMS.ED
v2015.04.21.08

McAfee
PWS-FBZT!CEBFD912B22A
5600.6789

Microsoft Security Essentials
Backdoor:Win32/Vawtrak.A
1.1.11502.0

MicroWorld eScan
Trojan.GenericKD.2078594
16.0.0.333

NANO AntiVirus
Trojan.Win32.ZPACK.dmovhs
0.30.8.659

Norman
Heur.I
11.20150421

nProtect
Trojan.GenericKD.2078594
15.04.03.01

Panda Antivirus
Trj/Chgt.O
15.04.21.08

Qihoo 360 Security
HEUR/QVM20.1.Malware.Gen
1.0.0.1015

Quick Heal
Backdoor.Vawtrack.F4
4.15.14.00

Rising Antivirus
PE:Malware.XPACK-HIE/Heur!1.9C48
23.00.65.15419

Sophos
Mal/Vawtrak-H
4.98

Total Defense
Win32/Tnega.EdIJWSB
37.0.11529

Trend Micro House Call
TROJ_GEN.F0C2C00AQ15
7.2.111

Trend Micro
TROJ_GEN.F0C2C00AQ15
10.465.21

Vba32 AntiVirus
Backdoor.Papras
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
39044

ViRobot
Trojan.Win32.S.Agent.421888.ABH[h]
2014.3.20.0

File size:
412 KB (421,888 bytes)

Product version:
5.2.3790.0

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
CALC.EXE

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\1e02.tmp

File PE Metadata
Compilation timestamp:
4/2/1998 4:18:14 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:WOVyYrT9nkMCPRZSJhHDWoDJW23WjRUhXZgyEHQ7PVTShtovOLMsxle4uy9b2C1d:WOVyYf9kOVlWMKXGqLgfg1+kOCdPj

Entry address:
0x6FA3

Entry point:
54, 59, 89, 0D, A0, D5, 45, 00, 8B, D1, E9, 66, F1, FF, FF, 04, 8B, 45, FC, A5, 55, 8B, EC, 83, EC, 3C, C7, 45, C8, 03, 00, 00, 00, C7, 45, D0, 0C, 00, 00, 00, C7, 45, E8, 04, 00, 00, 00, C7, 45, F8, 1C, 55, 54, A1, C7, 45, CC, 05, 00, 00, 00, C7, 45, EC, 00, 00, 00, 00, C7, 45, D4, 00, 00, 00, 00, C7, 45, F0, 00, 00, 00, 00, C7, 45, DC, 00, 00, 00, 00, C7, 45, D8, 00, 00, 00, 00, E8, 2E, F1, FF, FF, 89, 45, E0, 89, 4D, C4, 89, 45, E4, C7, 45, C4, 28, 17, B4, F8, 81, 7D, F8, 1C, 55, 54, A1, 0F, 84, 78, 02...
 
[+]

Entropy:
7.4368

Code size:
152 KB (155,648 bytes)

Remove CALC.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.